# GCP: FAILED_PRECONDITION: Key creation is not allowed on this service account (constraints/iam.disableServiceAccountKeyCreation)

**Code:** `Key creation is not allowed on this service account` · **Category:** Google Cloud / Firebase · **Seen on:** Google Cloud

An organisation policy forbids creating downloadable JSON keys for service accounts.

## Meaning

New organisations enforce `iam.disableServiceAccountKeyCreation` by default. Prefer keyless options: Workload Identity (GKE), Workload Identity Federation (GitHub Actions/AWS), attached service accounts (Cloud Run, GCE) or impersonation. If keys are unavoidable, an Org Policy Administrator must relax the constraint for that project.

## Common causes

- Constraint iam.disableServiceAccountKeyCreation enforced
- Secure-by-default organisation policies
- Trying to use keys from CI
- Project inherits org-level policy
- Missing org-policy admin rights to change it

## Quick fix

1. Use Workload Identity Federation for CI instead of keys
2. Attach a service account to the runtime
3. Request a policy exception from an org admin

## Detailed fix by platform

### gcloud

1. `gcloud resource-manager org-policies describe iam.disableServiceAccountKeyCreation --project PROJECT`

## How to diagnose

1. **Policy** — Constraint enforced?
2. **Alternative** — Keyless possible?
3. **Admin** — Can change the policy?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/gcp/service-account-key-creation-disabled)